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Declaration of Sa 
Pursuant to 28 U.S.C Section 1746, EE make the following 
declaration. 


l. 


I am over the age of 21 years and I am under no legal disability, which would prevent me 
from giving this declaration. 

I was an electronic intelligence analyst under 305" Military Intelligence with experience 
gathering SAM missile system electronic intelligence. I have extensive experience as a white 
hat hacker used by some of the top election specialists in the world. The methodologies I 
have employed represent industry standard cyber operation toolkits for digital forensics and 
OSINT, which are commonly used to certify connections between servers, network nodes 
and other digital properties and probe to network system vulnerabilities. 

Tama US citizen and I resid iii location in the United States of America. 
Whereas the Dominion and Edison Research systems exist in the internet of things, and 
whereas this makes the network connections between the Dominion, Edison Research and 
related network nodes available for scanning, 

And whereas Edison Research’s primary job 1s to report the tabulation of the count of the 
ballot information as received from the tabulation software, to provide to Decision HQ for 


election results, 


. And whereas Spiderfoot and Robtex are industry standard digital forensic tools for evaluation 


network security and infrastructure, these tools were used to conduct public security scans of 
the aforementioned Dominion and Edison Research systems, 

A public network scan of Dominionvoting.com on 2020-11-08 revealed the following inter- 
relationships and revealed 13 unencrypted passwords for dominion employees, and 75 


hashed passwords available in TOR nodes: 
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Array 
( 
[id] => 544167324 
[luser] => ian.macvicar 
[domain] => dominionvoting.com 
[password] => jamley 


) 


Array 

( 
[id] => 599400504 
[luser] => jelena.tanaskovic 
[domain] => dominionvoting.com 
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8. The same public scan also showed a direct connection to the group in Belgrade as 
highlighted below: 
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(6 -~ w20... 
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Cc @ robtex.com/dns-lookup/dominionvoting.com 


8 results shown. | 









2400:cb00:27049:1::adf5:3bb3 


Domains or hostnames one step under this dom 
2606:4700:50: :adf5:3aad barracuda.dominionvoting.com 
2803:f800:50::6ca?:cOad belgrade.dominionvoting.com 
2803 :f800:50::6ca?:c1b3 
2a06:98c1:50::ac40:20ad 
108.162.192.175 


198 164797 707% 170 





webmail.dominionvoting.com 
www. dominionvoting.com 


4 results shown. 


9. Accursory search on LinkedIn of “dominion voting” on 11/19/2020 confirms the numerous 
employees in Serbia: 


Vukasin Dordevic « 3rd 
Ss Software Developer at Dominion Voting Systems 


Serco 





Edvan Sabanovic « 3rd 
® Senior Full-stack Web Developer 


Belgrade, Serbia 





Past Senior Web Developer at Dominion Voting Systems 
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10. An additional search of Edison Research on 2020-11-08 showed that Edison Research has an 
Iranian server seen here: 


dison CS fee Oe bee COO eo 





ay a SC eee Rem tT ef o]a-] a] a 





Inputting the Iranian IP into Robtex confirms the direct connection into the “edisonresearch”’ 


host from the perspective of the Iranian domain also. This means that it is not possible that the 
connection was a unidirectional reference. 
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A deeper search of the ownership of Edison Research “edisonresearch.com” shows a connection 
to BMA Capital Management, where shareofear.com and bmacapital.com are both connected to 


edisonresearch.com via a VPS or Virtual Private Server, as denoted by the “vps” at the start of 
the internet name: 
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Map data 2020 


Dominionvoting is also dominionvotingsystems.com, of which there are also many more 


examples, including access of the network from China. The records of China accessing the server 


are reliable. 


INTERNET ARCHIVE 
Loading. 


Http: //cdominionvotingsystems.com/ | 
17:47:48 February @7, 2611 


GOt an HTTP 362 response at crawl time 
Redirecting to. 


Attp: //wew. dominionvoting.com/ 


ell cricket © 


xX 


= C 


country: 
org: 
admin-c: 
tech-c: 
abuse-c: 
mnt-—Lower: 
mnt-routes: 
mnt-by: 
mnt-irt: 


last-modif ied: 


source: 


Arts 
address: 
e-mail: 


abuse~mai box: 


admin-c: 
tech-c: 
auth: 
remarks: 
mnt-by: 


Last-modified: 


source: 


organisation: 
org-name: 
country: 
address: 
phone: 
e-mail: 
mnt-ref: 
mnt-by: 


last-modified: 


source; 


role: 
address: 
country: 
phone: 
e-mail: 
admin-c: 
tech-c: 
nic-hdl: 
remarks: 


abuse~mailbox: 


6:01 PM 36% 8 ) 


mobile.twitter.com 





& whois.ipip.net/AS132839 B 


HK 

ORG-PLCL1~AP 
PLHC1~AP 

PLHC1-AP 

APB44-AP 
MAINT-POWERL INE-HK 
MAINT~POWERL INE -HK 
APNIC-HM 
IRT-POWERL INE-HK 
2020-06-30715:14:17Z 
APNIC 


IRT-POWERL INE—HK 
UNIT 04,7/F,BRIGHT WAY, TOWER NO. 33 MONG KOK ROAD, Kowloon Hong Kong 9990 


PLHC1-AP 

PLHC1-AP 

# Filtered 

MAINT -POWERL INE -HK 
2020-06-30T15: 13: 262 
APNIC 


ORG-PLCL1-AP 

POWER LINE (HK) CO., 
HK 

FLAT A 6/F BLOCK B,MARVEL INDUSTRIAL BUILDING 17-23 KWAI FUN 
+852-68783777 


LIMITED 


APNIC-HM 

APNIC-HM 
2018-09~-297T12:55: 222 
APNIC 


ABUSE POWERL INEHK 

UNIT @4,7/F,BRIGHT WAY, TOWER NO. 33 MONG KOK ROAD, Kowloon Hong Kong 9990 
22 

+000000000 

PLHC1-AP 

PLHC1-AP 

AP844-AP 

Generated from irt object IRT-POWERLINE-HK 
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X 





CHINA UNICOM China169 Backbone - Fraud Risk 


Low Risk 





«— Lowest Risk Highest Risk — 


0 Fraud Score: 3 100 





We consider CHINA UNICOM China169 Backbone to be a potentially low fraud risk ISP, by which we mean that web traffic from this ISP potentially poses 
a low risk of being fraudulent. Other types of traffic may pose a different risk or no risk. They operate 1,889,865 IP addresses, some of which are running 





Domain Name: dominionvotingsystems.com 


Registry Domain ID: 2530599738_DOMAIN_COM-VRSN 

Registrar WHOIS Server: whois.godaddy.com 

Registrar URL: htto://www.godaddy.com. 

Updated Date: 2020-05-26T15:48:582 

Creation Date: 2020-05-267T15:48:572 

Registrar Registration Expiration Date: 2021-05-261T15:48:572 

Registrar: GoDaddy.com, LLC 

Registrar IANA ID: 146 

Registrar Abuse Contact Email: abuse@godaddy.com 

Registrar Abuse Contact Phone: +1.4806242505 

Domain Status: clientTransferProhibited http: //www.icann.org/epp#clientTransferProhibited 
Domain Status: clientUpdateProhibited http: //www.icann.org/epp#clientUpdateProhibited 
Domain Status: clientRenewProhibited http://www.icann.org/epp#clientRenewProhibited 
Domain Status: clientDeleteProhibited http: //www.icann.org/epp#clientDeleteProhibited 
Registrant Organization: 

Registrant State/Province: Hunan. 

Registrant Country: CN 

Registrant Email: Select Contact Domain Holder link at 

https: //www.godaddy.com/whois/results.aspx?domain=dominionvotingsystems.com 
Admin Email: Select Contact Domain Holder link at 

https: //www.godaddy.com/whois/results.aspx?domain=dominionvotingsystems.com 
Tech Email: Select Contact Domain Holder link at 

https: //www.godaddy.com/whois/results.aspx?domain=dominionvotingsystems.com 


Name Server: NSI DNS ¢ “OM 
Name Server: N52. DNS COM. 
DNSSEC: unsigned 
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Overview - © dominionvotingsystems.com 


DNS Records [4] 


Type 


A 


NS 


NS 


SOA 


Domains with same A records - © dominionvotingsystems.com 


1 Domains with same A records 


© boaogtobal.com 


CVE - © dominionvotingsystems.com 


22 cve 


CVE-2018-20685 


CVE-2015 6564 


CVE-2016-1908 


CVE-2016-10010 


CVE-2016-6515 


CVE 2015 5600 


CVE-2035-6563 


CVE-2018-15919 


Base Score 


26 


69 


7S 


69 


768 


85 


Lg 


CVE - © dominionvotingsystems.com 


CVE 202015778 


CVE-2019-6110 


CWE-2016-10011 


CVE-2016-10012 


CWE-2015-5352 


CVE-2015-B325 


CWE-2016-10009 


CVE.2016 10708 


CV¥E-2019-6109 


CVE-2016-6210 


CVE-2020-14145 


CVE-2016.3115 


21 


43 


72 


43 


43 


ss 


Value OSH Security score 
El 445.195.162.194 - AS132839 - POWER LINE DATACENTER 2 wo 615 
nsl.dns.com 
Wl 227.152.186.193 - AS133776 - Quanzhou 9 Hit 100 
Ml 119.167.180.131 - AS4837 - CHINA UNICOM China169 Bac... 8 HH 100 
MM 218.98,111.202 - AS21859 - ZNET 14 Hitt 100 
ns2.dns.com 
MB 183.253.57.193 - AS9808 - Guangdong Mobile Communic... 6 Hilt 100 
WB 121.12.104.65 - AS134763 - CHINANET Guangdong provin... 4 Hitt 100 
nsl.dns.com 
Hostname 
© dnsadmin.dns.com 
View all DNS Records 
Site Title Alexa rank ONSA™ osH” DNS CNAME 
= = Ell 45.195.162.194 - AS132839 - POWER LINE DATACENTER 2 - 
TE Columns 0 Copy Download 
Severity Vector Source Description 
In OpenSSH 7.5, scp.c in the scp client allaws remote SSH servers to bypass intended access restrictians via the filename of _ or an empty filename, The 
oO! AN! H/AuN CNP 45.195.162.154 
- ice . ienpact is modifying the permissions of the target directory on the client side. 
Use-after-free wainerability in the mm_answer_pam_free_ctx function in monitor.c im sshd in OpenSSH hefore 7.0 on nan-OpenaSo platforms might 
MEDIUM Av: Ma NICO: 195.162. 
eons ROMPRES See allow local users to gain privileges by leveraging control of the sshd uid to send an unexpectedly early MONITOR_REQ PAM_FREE_CTX request. 
The client in OpenSSH before 7.2 mishandios failed cookie generation for untnasted X11 forwarding and relies on the local X11 server far access-cantral 
HIGH AVINJAC:LIAu:NICPYEPYAP 445.195.162.194 decisions, which allows remote X21 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this 
X11 server, as demonstrated by lack of the SECURITY extension on this X11 server. 
sshd in OpenSSH before 7.4, when privilege separation is aot used, creates forwarded Unix-domain sockets as root, which might allow local users to gain 
7 iL b 
MEDIV! AVL JACM Raa NICO ICIS 45.195,162.194 = vie onspecitied allt i 
, The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows 
AW! $ “ Ne 5.19! 1 
He MNCL NECN aa remote attackers to cause a denial of service (crypt CPU consumption) via a long string. 
The kbdint_next_device function in auth2-chaill.c in sshd in OpenSSh through 6.9 does not property restrict the processing of keyboard-interactive 
wage AVIN(AC:LIAU:N/CPAUASC ah.105.162.184 devices within a single connection, which makes It easier for remate attackers to conduct brute-force attacks or cause a denial of service (CPU 
. on =~ consumption) via a tong and duplicative list in the ssh -oKbdinteractiveDevices option, as demonstrated by a modified client that provides a different 
password for each pam element on this fist 
The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous usermame data in MONITOR_REQ_PAM_INIT_CTX 
Low ASL JACM (aa NOON SEP IAN 45,195,162,194 requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to 
send 2 crafted MONITOR_REQ PWNAM request, related to monitor.c and monitor_wrap.c. 
Remotely observable behaviour in auth-gss2.c in OpenSSH through 7.8 could be used by remote attackers to detect existence of users an a target system 
MEDIUM ANN JACLIAUNSCPPEIACN 445.195.162.194 when GSS2 is in use. NOTE: the discoverer states ‘We understand that the OpenSSH developers do not want to treat such a username enumeration (or 
“oracie”} as a vulnerability” 
S¢p in OpenSSH through 8 3p1 allows command injection in the scp.c toremote function, as demonstrated by Dacktick characters in the destination 
MEDIUM AVSIM NIC PY EP IAP 485.195.162.194 argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of “ancenalous argument transfers’ because that could “stand 
8 great chance of breaking existing workllows.” 
In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can 
I/AC:Hi PLP ae 
an me EMCOLAEN PS manipulate the client output, for example to use ANS! control codes to hide additional files being transferred 
authilile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain 
A 4 PENIS 195.162, 
ow a ee sensitive private-key information by leveraging access to a privilege-separated child process. 
The shared memory manager (assoxiated with ore-authentication compression) in sshd im OpenSSH before 7.4 does not ensure that a bounds check is 
HIGH AVALJACLA NOC IEC iA 445.195.162.194 enforced by all compilers, which might allows local users to gain privileges by leveraging access to a sandboxed privilege separation process, related to 
the m_zback and m_20® data structures. 
The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX.11 Trusted mode is not used, lacks a check of the refusal 
MEDIUM AV.NJACM AUN ICON IL PIAGN 45,195.162,194 deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted 
time window. 
The do_setup_erw function in session.c in sshd in OpenSSH through 7.2p2, when the UseLogin feature is enabled and PAM is configured to read 
wIGH AVLIAC LIAN CCIE CfAr 45.195.162.194 .paen_eewiroament files in user home directories, allows local users to gain privileges by triggering 4 crafted environment for the /bin/login program, as 
Gemonstrated by an LD_PRELOAD environment variable. 
Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PACS#11 
AV INIAL: LN /CPYLPIALP 45.195.162, 
ee ‘i seciataiidddialitn casita modules by leveraging control over a forwarded agent-socket. 
sshd im OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an cut-of-sequence 
uM A +: EN SCN/NIACP 45.195.162. 
on Ea a sac NEWKEYS message, a3 demonstrated by Honggfuzz, related to kex.c and packet.c. 
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, 2 malicious server [or Man-in-The-Middle attacker} 
MEDIUM AINA HIAUN/C: PY: PAN 45.195.162.194 can employ crafted object names to manipulate the client output, e.g, by using ANS! control codes to hide additional files being transferred, This atfects 
refresh_progress_meter() in progressmeter.c. 
sshd in OpenSSH before 7.3, when SHA2S6 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the 
MEDIUM ANN: MN ICCPYENJACN 445.195.162.194 username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large 
password is provided. 
: ae ; The client side in OpenSSH 5,7 through &3 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows, 
= tl eo in-the-niddle attackers to target initial connection attempts (where no hast key for the server has been cached by the client), 
F t} ’ 
MEDIUM AVINIACA (uc /C:P/LPIAN 45.195.162.194 Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to bypass intended shell- 


command restrictions via crafted X12 forwarding data, related to the {1} do_authenticated! and (2) sessian_x11_req functions. 
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11. BMA Capital Management is known as a company that provides Iran access to capital 


markets with direct links publicly discoverable on LinkedIn (found via google on 


11/19/2020): 
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www.linkedin.com >» muhammad-talha-a0759660 

Muhammad Talha - BMA Capital Management Limited 

Manager, Money Market & Fixed Income at BMA Capital Management Limited. BMA Capital ... 
Manager-FMR at Pak Iran Joint Investment C any. Pakistan. 
Pakistan - Manager, Money Market & Fixed Income - BMA Capital Management Limited 





The same Robtex search confirms the Iranian address 1s tied to the server in the Netherlands, 
which correlates to known OSINT of Iranian use of the Netherlands as a remote server (See 
Advanced Persistent Threats: APT33 and APT34): 
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12. A search of the indivisible.org network showed a subdomain which evidences the existence 
of scorecard software in use as part of the Indivisible (formerly ACORN) political group for 
Obama: 































































































13. Each of the tabulation software companies have their own central reporting “affiliate”’. 
Edison Research is the affiliate for Dominion. 
14. Beanfield.com out of Canada shows the connections via co-hosting related sites, including 


dvscorp.com: 
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This domain redirects to beanfield.com 


DNS 
A 96.45.195.194 5 Domains 
MX 10 barracuda.dominionvoting 2 Domains 
NS ns29.domaincontrol.con 56,979,357 Domains 
ns30.domaincontrol.com 56,979,357 Domains 
Co-Hosted 
Aichi show All — 
guta.ca ndbgroup.ca 
alyokuacardiolounge.com grantdyer.com 
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View API — 


View API — 


This Dominion partner domain “dvscorp” also includes an auto discovery feature, where new in- 
network devices automatically connect to the system. The following diagram shows some of the 
related dvscopr.com mappings, which mimic the infrastructure for Dominion and are an obvious 
typo derivation of the name. Typo derivations are commonly purchased to catch redirect traffic 
and sometimes are used as honeypots. The diagram shows that infrastructure spans multiple 
different servers as a methodology. 


dvs 


@ Overview © Correlations... ~ 


= Browse by... ~ 


Wr Starred 


® Visualize... ~ 


& Settings i=] Logs ~ 





Data Summary > Data Type: Similar Domain (10 results) 


# similar Domain TLDSearcher g%1 


dvscopr. 5! )»0!.ir 

= similar Domain Tool-DNSTwist sf 1 

dv.scopr.com 

similar Domain Tool-DNSTwist gf 1 
a dvscorp.com 

# similar Domain TLD Searcher 

dvscopr. i= 

# similar Domain TLD Searcher 


dvscopr.fin.ci 


Data Element 


[vio - eee © | +- 1 oe 


Source Data Element 

Internet Name SpiderFoot U! as | i) 
dvscopr.com 

Domain Name SpiderFoot Ul gf 7 @ 
dvscopr.com 

Domain Name SpiderFoot Ul gf 7 Gg 
dvscopr.com 

Internet Name SpiderFoot U! a | ao 
dvscopr.com 

Internet Name SpiderFoot UI a S$ o 


dvscopr.com 
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Domain Name: DSVCORP.COM dsvcorp.com 
Oo Registry Domain ID: 134773082_DOMAIN_COM-VRSN 


Registrar WHOIS Server: whois.bookmyname.com 


Similar Domain - Whois Whois ti) = similar Domain TLD Searcher {3} 


% This is the IRNIC Whois server v1.6.2. dvscorp. 4! ,0!.ir 
Oo % Available on web at http://whois.nic.ir/ 


% Find the terms and conditions of use on http://www.nic.ir/ 


= similar Domain TLD Searcher oO Internet Name SpiderFoot U! 9 oO 
dvscopr.caa.1li dvscopr.com 
= similar Domain TLD Searcher sh 1 oO Internet Name SpiderFoot UI! st 3 oO 
dvscopr.hasura-app.io dvscopr.com 
= similar Domain TLD Searcher o Internet Name SpiderFoot U! st 3 oO 
dvscopr.rackmaze.com dvscopr.com 
# similar Domain TLDSearcher 1 o Internet Name SpiderFoot Ul 539 oO 
dvscopr.devices.resinstaging.io dvscopr.com 
# similar Domain TLDSearcher sii Oo Internet Name SpiderFoot Ul 39 ia 
dvscopr.cust.dev.thingdust.io dvscopr.com 


The above diagram shows how these domains also show the connection to Iran and other 


places, including the following Chinese domain, highlighted below: 


TL Serre rib} 


Chinese Domain 





dle Gee TLS Daarces 0 


dvscoor.fin.ci 


15. The auto discovery feature allows programmers to access any system while it is connected to 
the internet once it’s a part of the constellation of devices (see original Spiderfoot graph). 
16. Dominion Voting Systems Corporation in 2019 sold a number of their patents to China (via 


HSBC Bank in Canada): 


10 
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Assignment details for assignee "HSBC BANK CANADA, AS 


COLLATERAL AGENT” 


Assignments (1 total) 


Assignment 1 


Reel/frame Execution date Date Pages 
| recorded 
050500/0236 Sep 25, 2019 Fi 
sep 26, 
2019 
Conveyance 
SECURITY AGREEMENT 
Assignors Correspondent Attorney docket 


DOMINION VOTING SYSTEMS CORPORATION 


Assignee 
HSBC BANK CANADA, AS COLLATERAL AGENT 
4TH FLOOR, 70 YORK STREET 
TORONTO M5J 139 


CANADA 


CHAPMAN & CUTLER LLP 
12/0 AVENUE OF THE 
AMERICAS, 30TH FLOOR 
ATTN: SOREN SCHWARTZ 
NEW YORK, N¥ 10020 
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Properties (18) 
Patent Publication Application PCT International 
registration 
BE44813 20130306724 13476836 
8913/8? 20130301873 1347/0091 
9202113 20150071501 14539684 
8195505 20050247783 11121997 
98/0666 20120232963 13463536 
9710988 20120259680 13525187 
98/066/ 20120259681 13525208 
#111782 20040238632 10811969 
#422151 200/0012/76/ 11526028 
D599131 29374781 


View all 


This searchable database contains all recorded Patent Assignment information from August 1980 to the 


present. 


When the USPTO receives relevant information for its assignment database, the USPTO puts the information in 
the public record and does not verify the validity of the information. Recordation is a ministerial function-the 
USPTO neither makes a determination of the legality of the transaction nor the right of the submitting party to 


take the action. 


Release 2.0.0 | Release Notes | Send Feedback | Legacy Patent Assignment Search | Legacy Trademark 


Assignment Search 
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Of particular interest 1s a section of the document showing aspects of the nature of the patents 


dealing with authentication: 


Patent assignment 050500/0236 
SECURITY AGREEMENT & 


i: C-- 


Date recorded Reel,'frame Pages 
Sep 26, 2019 050500/0236 T 


Execution date 
Sep 25, 2019 


Comrespondent 





CHAPMAN & CUTLER LLP 
1 Fi STR 1270 AVENUE OF THE AMERICAS, 30TH FLOOR 
TORONTO M5J 159 ATTN: SOREN SCHWARTZ 
CANADA NEW YORK, Nit 100.20 
Properties (16 total) 
Patent Publication Application 


1. SYSTEMS AND METHODS FOR PROVIDING SECURITY IN A VOTING MACHINE 
nventors: JOHN PAUL HOMEWOOD, THOMAS E. REELING, RAUL DAVID TERWILLIGER, MARC R. LATOUR 


7111782 2000228632 10811969 
Sep 276, 2006 Dec 2, 2004 Mar 30, 2004 


2. SYSTEM, METHOD AND COMPUTER PROGRAM FOR VOTE TABULATION WITH AN ELECTRONIC AUDIT TRAIL 
nventors: JOHN POULOS, JAMES HOOVER, NICK IKONOMAKIS, GORAN OBRADOVIC 


a7195505 2005024 7783 11721997 
Jun 5, 2072 Now 10, 2005 May 5, 2005 


3. SYSTEMS AND METHODS FOR PROVIDING SECURITY INA VOTINGG MACHINE 
inventors: JOHN PAUL HOMEWOOD, THOMAS E. KEELINKS, PAUL DAVID TERWILLIGER, MARC R.LATOUR. 


F422151 20070012 76 171526028 
Sep 9, 2008 Jan 18, 2007 Sep 25, 2006 





17. Smartmatic creates the backbone (like the cloud). SCYTL 1s responsible for the security 


within the election system. 
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18. In the GitHub account for Scytl, Scytl Jseats has some of the programming necessary to 
support a much broader set of election types, including a decorator process where the data 1s 


smoothed, see the following diagram provided in their source code: 
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19. Unrelated, but also a point of interest is CTCL or Center for Tech and Civic Life funded by 
Mark Zuckerberg. Within their github page (https://github.com/ctcl), one of the programmers 
holds a government position. The Bipcoop repo shows tanderegg as one of the developers, 


and he works at the Consumer Financial Protection Bureau: 
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}’ master ~ FP ibranch G50 tags 


© tanderegg Setup ab for travis 


S app Iniiti 


fe config Set 


Tim Anderegg 


tanderegg 
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Washington DC 


20. As seen in included document titled 


vA 


“AA20-304A- 

Iranian Advanced Persistent Threat Actor Identified Obtaining Voter Registration Data 
” that was authored by the Cybersecurity & Infrastructure Security Agency (CISA) with a 
Product ID of AA20-304A on a specified date of October 30, 2020, CISA and the FBI 
reports that Iranian APT teams were seen using ACUTENIX, a website scanning software, to 
find vulnerabilities within Election company websites, confirmed to be used by the Iranian 
APT teams buy seized cloud storage that I had personally captured and reported to higher 
authorities. These scanning behaviors showed that foreign agents of aggressor nations had 
access to US voter lists, and had done so recently. 

In my professional opinion, this affidavit presents unambiguous evidence that Dominion 
Voter Systems and Edison Research have been accessible and were certainly compromised 
by rogue actors, such as Iran and China. By using servers and employees connected with 
rogue actors and hostile foreign influences combined with numerous easily discoverable 


leaked credentials, these organizations neglectfully allowed foreign adversaries to access data 
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and intentionally provided access to their infrastructure in order to monitor and manipulate 
elections, including the most recent one in 2020. This represents a complete failure of their 
duty to provide basic cyber security. This is not a technological issue, but rather a 
governance and basic security issue: if it is not corrected, future elections in the United States 


and beyond will not be secure and citizens will not have confidence in the results. 


I declare under penalty of perjury that the forgoing is true and correct to the best of my 


knowledge. Executed this November 23", 2020. 
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